{{- if .Values.nodeManager.internal.capsControllerManagerEnabled }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  {{- include "helm_lib_module_labels" (list . (dict "app" "caps-controller-manager")) | nindent 2 }}
  name: caps-controller-manager-validating-webhook-configuration
webhooks:
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        namespace: d8-cloud-instance-manager
        name: caps-controller-manager-webhook-service
        path: /validate-deckhouse-io-v1alpha1-sshcredentials
      caBundle: {{ .Values.nodeManager.internal.capsControllerManagerWebhookCert.ca | b64enc }}
    failurePolicy: Fail
    name: vsshcredentials.deckhouse.io
    rules:
      - apiGroups:
          - deckhouse.io
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - sshcredentials
    sideEffects: None
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        namespace: d8-cloud-instance-manager
        name: caps-controller-manager-webhook-service
        path: /validate-deckhouse-io-v1alpha1-staticinstance
      caBundle: {{ .Values.nodeManager.internal.capsControllerManagerWebhookCert.ca | b64enc }}
    failurePolicy: Fail
    name: vstaticinstance.deckhouse.io
    rules:
      - apiGroups:
          - deckhouse.io
        apiVersions:
          - v1alpha1
        operations:
          - UPDATE
          - DELETE
        resources:
          - staticinstances
    sideEffects: None
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        namespace: d8-cloud-instance-manager
        name: caps-controller-manager-webhook-service
        path: /validate-infrastructure-cluster-x-k8s-io-v1alpha1-staticmachine
      caBundle: {{ .Values.nodeManager.internal.capsControllerManagerWebhookCert.ca | b64enc }}
    failurePolicy: Fail
    name: vstaticmachine.deckhouse.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1alpha1
        operations:
          - UPDATE
        resources:
          - staticmachines
    sideEffects: None
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        namespace: d8-cloud-instance-manager
        name: caps-controller-manager-webhook-service
        path: /validate-infrastructure-cluster-x-k8s-io-v1alpha1-staticmachinetemplate
      caBundle: {{ .Values.nodeManager.internal.capsControllerManagerWebhookCert.ca | b64enc }}
    failurePolicy: Fail
    name: vstaticmachinetemplate.deckhouse.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1alpha1
        operations:
          - UPDATE
        resources:
          - staticmachinetemplates
    sideEffects: None
{{- end }}
